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TT<fTHR CLAIMS: 

Please CANCEL claims 2, 9. 14 and 18 without prejudice. 

Please AMEND claims 1.3,4. 5, 7. 10, 13, 15, 16. 19-21 and 23 as follows: 



1 1 (Amended) A system for detecting and selectively removing viruses in 

2 data transfers, the system comprising: 
a memory for storing data and routines, the memory having inputs and outputs, 

^ the memory including a server for scanning data for a virus and 

5 specifying data handling actions dependent on an existence of the virus; 

6 a communications unit for receiving and sending data in response to control 

7 signals, the communications unit having an input and an output; [and] 
g a processing unit for receiving signals frotn the memory and the 

communications unit and for sending signals to the memory and 
communications unit; the processing unit having inputs and outputs; the 

1 1 inputs of the processing unit coupled to the outputs of memory and the 

^2 output of the communications unit; the outputs of the processing unit 

13 coupled to the inputs of memory, the input of the communications unit, 

14 the processor controlling and processing data transmitted through tiie 

15 communications unit to detect viruses and selectively transfer data 

16 depending on the existence of viruses in the data being transnutted[.]; 

17 ^ prn^v server f^ r rP-r^iving daU , ^» hP. tr^nsfeTred the, nroxv serVfT scanning 
Ig thft data to be tr i^»>^fp,TTfi^ l for viruses and controlling tranf^mlsi^ion Pf thf^ 

19 ^p itfl tr. he trans fcTTed accordinp to nrescthainlinf infjmTCtipns and ^ifi 

20 pe.<ieiice of viri ise.s. fhft proxy ^^^^ li»vinp a data input, a data. QHffiH t 
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o^f l , ^ rontToi nutr r f t,^ H.t. in put munlfid to receive thfi jafa tff 

^ H^f^rr^nr. for fr >.ii«f«»TiTig data f rom thp pro x y sm^r in mpo^^9 \o QQntT?! 

aifT^ni ^ from the proxy 5 ? frv^ the, daemon havinp a CQPfrol inptft, a. 4ata 
inp,i t « data outP U f thft control iDPiit of thg d^eanpn gWpted t«? tbfi 
^^«|r»^ ♦^^^ F^ ^ Y 8?"^^^ fo^* Tereivinp cnntTol signals, and th? 

^pif fl input of the ( Hfl ftmnn cmiplaH to the dat ^^ mUpiit of the PTOXV SCTver. 
f^r yfi;-Hving the <i}]\^ to tranafeiTed. 
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5^. (Amended) The system of claim [2] X, wherein the proxy server is a 
FTP proxy server that handles evaluation and transfer of data files, and the daemon is 
an FTP daemon that communicates with a recipient node and transfers data files to the 
recipient node. 

(Amended) The system of claim [2] 1. wherein the proxy server is a 
SMTP proxy server that handles evaluation and ttansfer of messages, and the daemon 
is an SMTP daemon that communicates with a recipient node and transfers messages 
to the recipient node. 

f ^. (Amended) A computer implemented method for detecting viruses in 
data transfers between a first computer and a second computer, the method comprising 
the steps of: 

receiving at a server a data transfer request including a destination address; 
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electronically^^SaS^ data^tiie server; 
detennining whether the data contains a viius at the server; 
peifonning a preset action on the data using the server if the data contains a 
virus; [and] 

sending the data to the destination address if the data does not contain a 
virus[.]i 

^Pl^^^nin«^ whft thi-T thft data is o f n tvce that is m\y to rontain a yjrus ; and 
tTT.r.RmitHng th ^ H«tn from the 8 P,T v er to the d fif^tin fl t^nn without pgrfgrming thfi 

fit^p R rfPtftrminifig w ^ftfh "- ^^^^ contains a vims f»Tid performing a 
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f^X' (Amended) The method of claim/, wherein the step of scanning is 
performed using [in] a signature scanning process. 

^>0r (Amended) The method of claim [9]^. wherein the step of determining 
whether the data is of a type that is likely to contain a virus is performed by comparing 
an extension type of a file name for the data to a group of known extension types. 
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' ' yf. (Amended) A computer implemented method for detecting viruses in a 
mail message transferred between a first computer and a second computer, the method 

comprising the steps of: 

receiving a mall message request including a destination address; 
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the mail message kJ'a server; 
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determining whether the mail message contains a virus fhf. fletrnninato of 

yl, ^ n..^l messar f ^ Ti r^ n^^-^ ""^ ^^^^^^^ ^^^^ 

f»r,rnHp.ri portion nf t^^ "'"^^ "'gssaPP in n f^f.paratp tempgrai:Y 

thP, encoded DT- l f -T-fi "^^^ 
P^^^^ff tl T^ rT..il mes ffflff ^ f""^"^ ^^^^^ ^^^^^^^ TlPTtTPns for 
^ ^nH t».ati n f> ffV.rr>i>^r ttie sfanntnp Step fOTlPtl ^nv YimSfiS ; 
performing a preset action on the mail message if the mail message contains a 
virus; and 

sending the mail message to the destination address if the mail message does 

not contains a virus. ^„» -->^ 

(Amended) The method of claim [14] {z, wherein the step of [scanning] 
^f>T ^rn,iHnp whether the mail message [for] inrllT^cs my encoded portions searches 
for uuencoded portions. 
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(Amended) [The method of claim 14. wherein:] _A compntfii : 

fnr detecti r p ^"^ik^^o in a mail messftgg transfP T Tf-rt MW^n^ 
W rnmniiter an i^ " R r""'^ comnntPT thfi method rpmprifiifff^ tfip St^P^ - Ofc 

1 1 ji m^nlf^fff^i^ '""^^ mftssage^ttf a servet. 

c .^^ ^ t.ii, fT mail ip ff fif ffl pp- fai- encoded portions; 

f^Pl^inj pfr whether tii?- mail message, contains a viius; 
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11 r^^t ^^titains fl vims- and 

12 ^} wherein the step of sending the mail message to the destination address is 

13 {f performed if the mail message does not contain any encoded portions; 

14 the server iticludes a SMTP proxy server and a SMTP daemon; and the 

15 step of sending the mail message comprises transferring the mail 
Ig message from the SMTP proxy server to the SMTP daemon [,] and 

17 transferring the mail message from the SMTP daemon to a node having 

1 g an address matching the destination address. 

. 1 (Amended) The method of claim [18]^, wherein step of scanmng is 

V 2 performed using [in] a signature scanning process. 

. ll 

1 ' X (Amended) The method of claim [14] ^, wherein the step of 

2 performing a preset action on the mail message comprises performing one step from 

3 the group of: 

4 transferring the mail message unchanged; 

5 not transferring the mail message; 

6 storing the mail message as a file with a new name and notifying a recipient of 

7 the mail message request of the new file name; and 
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' creating a modified mail message by writing the output of the determining step 

9 into the modified maU message and transferring the mail message to the 

destination address. 

1 (Amended) The method of claim [18] wherein the step of 

2 perfonning a preset action on the mail message comprises performing one step from 

3 the group of 1 

4 transferring the mail message unchanged; 

5 tiansfetiing the mail message with the encoded portions having a vims deleted; 

6 and 

7 renaming the encode portions of the mail message containing a virus, and 

8 storing the renamed portions as files in a specified directory on the 

9 server and notifying a recipient of the renamed files and directory; and 

10 writing the output of the detennining step into the mail message in place of 

1 1 respective encoded portions that contain a virus to create a modified 

12 mail message and sending the m odified mail message. 

1 X (Amended) The apparatus of claim ^, wherein means for determmmg 

2 includes a means for scanning that scans the data using [in] a signature scanning 



